Systems and methods for performing computer network service chain analytics

ABSTRACT

A system for performing computer network service chain analytics includes network-connected devices containing a plurality of virtual network functions having elements and a data model for storing a plurality of metrics related to the plurality of virtual network functions and a service chain intelligence engine in communication with the one or more network-connected devices and the data model. The memory device contains a set of instructions that causes a processor to analyze the plurality of virtual network functions to automatically identify one or more service chains, to automatically determine, using the data model, performance behavior characteristics of each element for each of the identified service chains and to automatically generate an alarm, in response to determining that the performance behavior characteristics of one or more elements of at least one of the identified one or more service chains does not meet a predefined set of the performance behavior characteristics.

CROSS REFERENCE TO RELATED APPLICATION

This application claims priority to and the benefit of, pursuant to 35U.S.C. § 119(e), U.S. provisional patent application Ser. No.62/384,523, filed Sep. 7, 2016, entitled “SYSTEM AND METHODS FORPERFORMING COMPUTER NETWORK SERVICE CHAIN ANALYTICS,” which isincorporated herein in its entirety by reference.

FIELD OF THE INVENTION

The disclosed embodiments generally relate to service-centric andlogical function oriented network architectures for data centers, andmore particularly, to performing service chain analytics for macro andmicro elements in a computer network service chain.

BACKGROUND

Using network function virtualization (NFV) and software definednetworking (SDN), deployments utilizing service chain architecture arebecoming more common. For example, a service chain deployment mayinvolve a number of virtualized network functions (VNFs) connected orchained together to perform one or more services. In this example, eachvirtualized network function may include one or more virtual machines(VMs), virtualization containers, and/or other software implementedusing various hardware. While SDN and NFV may reduce the need forspecialized hardware for network functions or related service, issuescan arise when deploying virtualized network functions across complexnetwork topologies. For example, provisioning, testing, troubleshooting,and isolating faults can be more difficult in environments that use NFV.

Accordingly, a need exists for methods, systems, and computer readablemedia for provisioning NFV.

SUMMARY

Certain aspects of the present disclosure relate to performing computernetwork service chain analytics.

In accordance with a purpose of the illustrated embodiments, in oneaspect, a system for performing computer network service chain analyticsincludes one or more network-connected devices containing a plurality ofvirtual network functions having one or more elements. The systemfurther includes a data model for storing a plurality of metrics relatedto the plurality of virtual network functions. The system also includesa service chain intelligence engine including a processor and a memorydevice coupled to the processor in communication with the one or morenetwork-connected devices and in communication with the data model. Thememory device contains a set of instructions that, when executed by theprocessor, cause the processor to analyze the plurality of virtualnetwork functions to automatically identify one or more service chains.The set of instructions that, when executed by the processor, furthercause the processor to automatically determine, using the data model,performance behavior characteristics of each element for each of theidentified service chains and to automatically generate an alarm, inresponse to determining that the performance behavior characteristics ofone or more elements of at least one of the identified one or moreservice chains does not meet a predefined set of the performancebehavior characteristics.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure will become more fully understood from thedetailed description and the accompanying drawings. These accompanyingdrawings illustrate one or more embodiments of the present disclosureand, together with the written description, serve to explain theprinciples of the present disclosure. Wherever possible, the samereference numbers are used throughout the drawings to refer to the sameor like elements of an embodiment.

FIG. 1 is a diagram illustrating elements or components of an exampleoperating environment in which embodiments of the present invention maybe implemented.

FIG. 2 illustrates examples of service chains implemented using VNFs.

FIG. 3 schematically shows a workflow of the steps performed by aservice chain intelligence engine (SCIE), according to certainembodiments of the present disclosure.

DESCRIPTION OF CERTAIN EMBODIMENTS

The illustrated embodiments are not limited in any way to what isillustrated as the illustrated embodiments described below are merelyexemplary, which can be embodied in various forms, as appreciated by oneskilled in the art. Therefore, it is to be understood that anystructural and functional details disclosed herein are not to beinterpreted as limiting, but merely as a basis for the claims and as arepresentation for teaching one skilled in the art to variously employthe discussed embodiments. Furthermore, the terms and phrases usedherein are not intended to be limiting but rather to provide anunderstandable description of the illustrated embodiments.

Unless defined otherwise, all technical and scientific terms used hereinhave the same meaning as commonly understood by one of ordinary skill inthe art to which this invention belongs. Although any methods andmaterials similar or equivalent to those described herein can also beused in the practice or testing of the illustrated embodiments,exemplary methods and materials are now described.

It must be noted that as used herein and in the appended claims, thesingular forms “a”, “an,” and “the” include plural referents unless thecontext clearly dictates otherwise. Thus, for example, reference to “astimulus” includes a plurality of such stimuli and reference to “thesignal” includes reference to one or more signals and equivalentsthereof known to those skilled in the art, and so forth.

It is to be appreciated the illustrated embodiments discussed below arepreferably a software algorithm, program or code residing on computeruseable medium having control logic for enabling execution on a machinehaving a computer processor. The machine typically includes memorystorage configured to provide output from execution of the computeralgorithm or program.

As used herein, the term “software” is meant to be synonymous with anycode or program that can be in a processor of a host computer,regardless of whether the implementation is in hardware, firmware or asa software computer product available on a disc, a memory storagedevice, or for download from a remote machine. The embodiments describedherein include such software to implement the equations, relationshipsand algorithms described above. One skilled in the art will appreciatefurther features and advantages of the illustrated embodiments based onthe above-described embodiments. Accordingly, the illustratedembodiments are not to be limited by what has been particularly shownand described, except as indicated by the appended claims.

In exemplary embodiments, a computer system component may constitute a“module” that is configured and operates to perform certain operationsas described herein below. Accordingly, the term “module” should beunderstood to encompass a tangible entity, be that an entity that isphysically constructed, permanently configured (e.g., hardwired) ortemporarily configured (e.g. programmed) to operate in a certain mannerand to perform certain operations described herein.

In the context of the present description, the terms “network” and“communication network” refer to the hardware and software connectingone or more communication elements including wireline networks, wirelessnetworks, and/or combinations thereof.

The terms “network function virtualization” (NFV) and virtual networkfunction (NFV) are described in a series of documents published by theEuropean Telecommunications Standards Institute (ETSI) and availablefrom the ETSI website. The term “virtual network function or feature”(VNF) refers to a particular implementation of a function, a feature, ora service provided by the network, internally within the network, orexternally to a customer, subscriber, end-user, a terminal or a server.A VNF may include the software program implementation of the function orfeature or service. The term VNF instance (VNF-I) refers to a particularprocess or task executing the VNF program by a particular virtualmachine or processor or computing facility and/or used by a particularcustomer (or subscriber, end-user, terminal or server, etc.).

The term “service” refers to any type of use (such as a use case) thatan NFV-based communication network may offer or provide to one or morecommunication elements. A service may include switching data or contentbetween any number of elements, providing content from a server to acommunication element or between servers, securing and protectingcommunication and content, processing content provided by the customeror by a third party, providing backup and redundancy, etc. A service maybe using partial functionality of a VNF or may include one or more VNFsand/or one or more VNF instances forming a service sub-network (orinterconnection model). In the context of the present description, theterm “chain” may refer to such service sub-network, such as a particularplurality of VNFs and/or VNF instances associated with particularservice type or a service instance.

In various embodiments, a network of wired and/or wireless nodes uses aNetwork Function Virtualization (NFV) Infrastructure (NFVI). By using anNFVI, network functions can be instantiated at a variety of differentlocations where underlying hardware infrastructure is available. Networkfunctions can be placed where they are needed, when they are needed, andcan then be either taken down or moved according to the needs of thenetwork. The VNFs that may be supported by the NFV infrastructure mayinclude, for example, functions for flow control (e.g., includingordering and rate matching), reliability (e.g., including data lossidentification, data loss indication, and data recovery), security(e.g., including end-to-end or network security), data forwarding,out-of-order control (e.g., including packet sequence numbers),fragmentation/reassembly, compression, congestion, error control, namedcontent delivery (e.g., including content interest storage, contentholder identification, content data blocks caching, contentidentification and content security verification), data aggregation(e.g., reverse multicast aggregation), data holding (e.g.,delay-tolerant networking functions and retransmissions), and otherfunctions. Some VNFs that are instantiated on end or edge nodes mayperform functions that are end-to-end functions in a path across thenetwork. Some VNFs for performing, e.g., a reliability function, may beinstantiated, in a link connecting a pair of nodes and/or inmultiple-links over many nodes along a network path. Further, some VNFsmay be configured to work at different levels of complexity or increasedfunctionality (e.g., security function). The use of VNFs is one exampleof virtualization, which provides the ability to elastically support thefunctional demands of a network by allowing the functions that wereformerly discrete hardware resources to be virtualized, i.e., defined insoftware, on an underlying pool of physical resources. For example, aVNF may be virtualized as a single resource entity even when theunderlying hardware resources supporting the VNF are not all physicallyco-located or only include a portion of the component resources ofindividual physical devices.

A service provided by the communication network may be implemented usingone or more VNFs. For example, the service may be a group, or a chain ofinterconnected VNFs. The VNFs making the group, or the service, may beinstalled and executed by a single processor, by several processors onthe same rack, within several racks in the same data-center, or byprocessors distributed within two or more data-centers.

In accordance with one or more embodiments discussed here, describedare: service-centric and logical function oriented network architecturesfor data centers, a key enabling technique, and a Virtual NetworkFunction (VNF) service chain entity as defined below. In accordance withthe disclosed service-centric architecture, connectivity and networkingservices can be provided by service-customized virtual networks (SCVNs).

FIG. 1 is a diagram illustrating elements or components of an exampleoperating environment in which embodiments of the present invention maybe implemented. In this example operating environment users can activelydefine, manage, and operate their virtual networks without reliance onnetwork provider technicians, as was necessitated by prior arttechniques. It is to be appreciated various embodiments disclosed hereinresult in a transformation of network architecture, operation, andmanagement.

In accordance with an illustrative embodiment the architecture of theSCVN 100 includes at least one hardware layer 102, a virtualizationlayer 104, and operations and management layer 105. The hardware layer102 preferably includes a pool of physical computing, networking andstorage resources.

In the example shown in FIG. 1, the virtualization layer 104 may includeone or more layers of software for performing one or more types offunctions including, but not limited to, managing virtualization ofhardware resources 102 and managing services within one or more nodes.

In the example, the virtualization layer 104 includes one or morecontrollers or services for managing one or more virtual machines (VMs),where each of VM is a collection of resources, such as virtual orphysical processor, memory and I/0 resources, from among hardwareresources 102, that are defined to run an operating system. Each VM maybe virtualized as a separate computer. Each VM may host a separateoperating system. Multiple VMs may access memory from a common memorychip; however, the ranges of addresses directly accessible to each ofthe VMs do not overlap. Processors may be dedicated to a single VM orshared by multiple VMs. The virtualization layer 104 may include only asingle VM or may include additional or alternate VMs.

In additional or alternate embodiments, the virtualization layer 104preferably provides multi-cloud aggregation and may include componentsthat are distributed across multiple clouds and that cooperate toprovide various services, such as, but not limited to, virtual computing106, virtual network 108 and virtual storage 110. In particularembodiments, virtual computing 106 (e.g., application, server software,software development environment, software test environment) comprisesone or more units of computing processing that is performed via aninfrastructure-as-a-service (IaaS) platform-as-a-service (PaaS), orsoftware-as-a-service (SaaS). For example, IaaS may comprise instancesof Microsoft® Windows or Linux running on a virtual computer, or aDesktop-as-a-service (DaaS) provided by Citrix® or VMWare®; a PaaS maycomprise a database server (e.g., MySQL® server), Samba server, Apache®server, Microsoft® IIS.NET server, Java® runtime, or Microsoft®.NET®runtime, Linux-Apache-MySQL-PHP (LAMP) server, Microsoft® Azure, orGoogle® AppsEngine; a SaaS may comprise SalesForce®, Google® Apps, orother software application that can be deployed as a cloud service, suchas in a web services model. A cloud-computing resource may be a physicalor virtual computing resource. In some embodiments, the virtual storage110 may include one or more cloud-computing storage resources (e.g.,Storage Area Network (SAN), Network File System (NFS), or Amazon S3®)and the virtual network 108 may include one or more network resources(e.g., firewall, load-balancer or proxy server). Furthermore, thevirtualization layer 104 may include an internal private resource, anexternal private resource, a secure public resource, aninfrastructure-as-a-service (IaaS) resource, a platform-as-a-service(PaaS) resource, or a software-as-a-service (SaaS) resource. Hence, insome embodiments, a cloud-computing service provided by thevirtualization layer 104 may comprise a IaaS, PaaS or SaaS provided byprivate or commercial (e.g., public) cloud service provider, such asAmazon Web Services®, Amazon EC2®, GoGrid®, Joyent®, Mosso®, or thelike.

In the operations and management layer 105 (with Software DefinedNetwork (SDN)), network functions may be virtualized to provide a VNF.It is to be understood that VNF component 114 a-114 g examples mayinclude (and are not to be limited to): firewalls, packets inspection,Network Operator's backbone systems like Mobility Management Entity(MME), Packet Data Network (PDN) gateway, and the like. It is to befurther understood these VNFs may be provisioned, deployed, executed,and deleted in a Software Defined Infrastructure (SDI). Such SDIs mayinclude a set of VNFs that are interconnected through the network tosupport one or more applications.

Communication between the virtual layer 104 and the VNFs 114 a-g may bedone through various protocols and architectural styles, including, butnot limited to, Simple Object Access Protocol (SOAP), eXtensible MarkupLanguage (XML), Simple Network Management Protocol (SNMP), andRepresentational State Transfer (REST). FIG. 1 illustrates in anembodiment in which communication between the virtual layer 104 and theVNFs 114 a-g is implemented using the REST Application ProgrammingInterface (REST API) 112.

It should be noted that conventional, prior art, network servicestypically require acquiring hardware components, which provide atransmission medium, such as coaxial cable or twisted pair. Furthermore,each service request typically requires specialized resources/interfaces(e.g., specialized hardware, databases, I/O devices, or any other devicewith its own command syntax, etc.), which increases the chances ofconfiguration errors. In contrast, the illustrated embodiments describedherein set forth a network architecture in which network functions aremoved into the SDI. In accordance with aspects of the embodiments,techniques are provided for maximizing data center resources while atthe same time minimizing compute bottlenecks that impact the ability tohandle customer application load. NFV/SDN and data center cloud serviceassurances, often included in service level agreements (SLAs), arenecessary to achieve a “programmable network” (e.g., SDI, NFV). Serviceassurances depend on the availability of hardware resources 102 tohandle increased customer usage. As concerns over security and storageusage grow so too does the demand for the processing power to handlecompute-intensive security operations (e.g., authentication, and dataencryption/decryption). Securing and storing data is compute-intensive,so much so that specialize hardware-acceleration is used frequently tohandle (or offload) tasks that if done on general purpose CPUs would becostly both in terms of CPU and latency. The embodiments provide amethod of managing a pool of hardware resources together with a group ofvirtual machines and virtual network functions. In practical terms, theembodiments of the present invention help data centers get the most outof the equipment (i.e., Servers) they have.

The illustrated NFV platform 101 may include a master serviceorchestrator (not shown in FIG. 1) that orchestrates instantiation ofVNFs 114 a-114 g and management of VNFs 114 a-114 g, includingperformance tuning as needed, to provide one or more of the services tousers (e.g., UEs). More particularly, the master service orchestratormay perform orchestration operations to instruct a plurality of VNFservice controllers to control a plurality of VNF pools, each containingone or more virtual resources for a specific type of VNF. In thismanner, the master service orchestrator provides an intelligentorchestration layer for VNF-based service chaining and resource sharing.

One illustrative advantage of this embodiment is thatconfiguring/constructing a VNF service chain no longer requiresacquiring hardware resources (as was required with the aforesaid priorart techniques). For example, a security monitoring VNF may beconfigured to receive provisioning data from the NFV security servicescontroller. Thus, the present invention SDN/VNF infrastructuresignificantly simplifies at least the service chain and applicationprovisioning process. It is to be appreciated the services that VNFservice chains may provide include, for instance, Voice-over-IP (VoIP),Video-on-Demand (VOD), IP Mobility Subsystem (IMS) and other mobilityservices, and Internet services to clients of a service providernetwork. Typically, each service chain has a specific order. Forexample, a mobility management entity (MME) interface application may bea part of an MME virtualized network function chain provided by avirtual server executing in a virtual computing environment, such as theSCVN 100.

Furthermore, the illustrated embodiments of the present inventionencompass an automated, service chain health analysis system (referredto hereinafter as a Service Chain Intelligence Engine (SCIE)) 116 whichdynamically matches, analyzes and transforms internal and external data.More specifically, the SCIE 116 is configured to automatically evaluatethe health and performance of various elements in VNF service chains(i.e., macro and micro elements discussed below in conjunction with FIG.2) via a common data model 118. The data model 118 is configured forstoring service chain element health metrics, dimensions and normalbehavior metrics representing metric values associated with normaloperation of a particular VNF service chain. According to embodiments ofthe present invention, it should be noted that the data stored in thedata model 118 gets derived from packet data 120, operating system dataand active agent measurements 124. In some embodiments, obtaining theplurality of packet data, O/S data and active agent measurement valuesis carried out by a plurality of monitoring probes monitoring usage(including normal usage) of the hardware resources 102.

Advantageously, the data model 118 provides an optimized and scalabledesign model. Examples of data that can be stored in the data model 118may include, but are not limited to, multi-dimensional data (i.e.,subscriber data, application data, device data, service data, etc.), aplurality of application/network metrics (i.e., traffic volume, errorcauses, response time, packet loss data, jitter, etc.) and various OSrelated metrics (i.e., CPU utilization data, memory utilization data,disk utilization data, etc.). In other words, the SCIE 116 may beconfigured to determine the health and performance of particular VNFelements by evaluating a common set of metrics/tests as well as usingdomain knowledge.

FIG. 2 illustrates exemplary ways to implement special-purpose servicechains using VNFs, according to some embodiments of the invention. Morespecifically, FIG. 2 illustrates a plurality of service chains 210, 220,230, 240 created using at least two of the plurality of NFV-basedapplications based on the information communicated between the pluralityof NFV-based applications. At least in some instances, the informationcan be communicated using, for example, border gateway protocol (BGP)exchanges between the NFV-based applications. For example, a firstservice chain 210 comprising elements 211-218 may represent a voice andvideo service chain. It is to be appreciated that in accordance with theillustrated embodiments, each VNF service chain 210, 220, 230, 240 mayinclude a plurality of VNF macro elements and may include two or moreVNF micro elements.

It is to be understood, in at least some embodiments, at least some ofthe provided services can be implemented as a sequence of steps. Forinstance, in one embodiment, the Dynamic Rate Allocation (DRA) VNFservice/network function may include a sequence of micro steps, such asDRA steps one, two and three required to implement the DRA service. InFIG. 2, a second service chain 220 represents the DRA VNF servicenetwork function and elements 211 a, 211 b and 211 c represent microelements. In other words, each of the steps required to implement theDRA service is represented in a corresponding VNF service chain 220 as aVNF micro element 211 a-211 c.

A third 230 and fourth 240 service chains illustrate chains consistingof only macro elements 211, 212, 213, 217, 219 and 211, 217, 218, 214,217, respectively. Examples of such

VNF macro elements include (and are not limited to) DRA service/networkfunction, Load Balancer service/network functions, Firewallservice/network function, and the like. It is to be understood, the SCIE116 is configured to determine the health of a variety of differentmacro VNF elements (e.g., elements 211-218) and/or micro VNF elements211 a-c. The SCIE 116 finds use in a variety of different “normalized”methods well-known in the art for any type of VNF to determine health ofmacro and/or micro elements. Each service chain performs a specificservice and has a specific order. For instance, each service chain mayprocess a specific service flow of network traffic. Some steps may berepeated more than once at different points within the service chainflow (e.g., elements 217 in the fourth service chain 240).

Before turning to description of FIG. 3, it is noted that the flowdiagram shown therein is described, by way of example, with reference tocomponents shown in FIGS. 1-2, although these operational steps may becarried out in any system and are not limited to the scenario shown inthe aforementioned figures. Additionally, the flow diagram in FIG. 3illustrates an example in which operational steps are carried out in aparticular order, as indicated by the lines connecting the blocks, butthe various steps shown in this diagram can be performed in any order,or in any combination or sub-combination. It should be appreciated thatin some embodiments some of the steps described below may be combinedinto a single step. In some embodiments, one or more additional stepsmay be included.

As shown in FIG. 3, at step 302, SCIE 116 starts the method byidentifying VNF service chains. According to example embodiments, themaster service orchestrator (not shown in FIG. 1) executed by the NFVplatform 101 not only can allocate virtualized network functions forcreation of a virtualized network service, but the master orchestratoralso can identify each of the virtualized network functions asinterdependent for coordinated execution of the virtualized networkservice, based on setting by the orchestrator an interdependencyindicator within each virtualized container associated with providing acorresponding virtualized network function for the virtualized networkservice. The interdependency indicator can create a “stateful” conditionin the virtualized container, enabling the virtualized container toutilize the interdependency indicator as a “pointer” toward avirtualized management entity associated with the virtualized networkservice.

In one embodiment, at step 302, the SCIE 116 may receive pointers to oneor more virtualized management entities from the master serviceorchestrator. The virtualized management entity, executed for example aspart of the SCIE 116, can receive information associated with theperformance of the virtualized container within the context of thevirtualized network service; hence, the SCIE 116 can monitor theperformance of each VNF and each individual VNF element within thecontext of the virtualized network service, and execute coordinatedchanges among the virtualized network functions associated with thevirtualized network service.

Next, at step 304, the SCIE 116 obtains metrics for each VNF element. AVNF element may have a list of requirements, or specifications, such asprocessing power, cash memory capacity, regular memory capacity (e.g.RAM, dynamic, or volatile memory, etc.), non-volatile memory (e.g. suchas flash memory, etc.) capacity, storage capacity, power requirements,cooling requirements, etc. A particular VNF element providing aparticular function (e.g. to a particular customer, entity, etc.) mayhave further requirements, or modified requirements, for example,associated with a particular quality of service (QoS) or SLA. Suchrequirements may include maximum latency or delay, average latency andmaximum variance (latency jitter), maximal allowed packet loss, etc.Other requirements may include service availability, redundancy, backup,provisions for roll-back and/or recovery, fault-tolerance, and/orfail-safe operation, etc.

A service made of a chain or a group of VNFs and their VNF elements mayhave a similar list of requirements, or specifications, covering theservice as a whole. Therefore, such requirements, or specifications, mayimply, affect, or include, requirements, or specifications, regardingcommunication links between the VNFs and/or the VNF elements. Suchrequirements, or specifications, may include bandwidth, latency,bit-error rate, and/or packet loss, etc. Such communication requirementsor specifications may further impose deployment limitations, orconstraints, requiring particular VNFs and/or VNF elements to reside inthe same data-center, or within the same rack, or even in the samecomputing device, for example, sharing memory or being executed by thesame processor. Security measures may add further requirements, orspecifications, such as co-location of some of the VNFs and/or the VNFelements. Thus, at step 304, the SCIE 116 obtains metrics related tovarious aforementioned requirements and specifications. As noted above,such metrics may be captured by a plurality of monitoring probes.Furthermore, according to embodiments of the present invention, the SCIE116 is configured and operable to utilize “active agent” test data. Asused herein, “active agent” refers to a common piece of code preferablyinserted into each VNF element to perform pre-determined availabilityand latency tests within various links of VNF service chains. In oneembodiment, such availability and latency tests may be implemented usingcode embedded into each VNF element. Alternatively, such tests could beperformed from a plurality of distributed points within the SDI.

At 306, the SCIE 116 compares the measurements obtained at 304 with apredefined set of requirements and specifications associated with eachVNF and/or VNF element. For instance, the SCIE 116 may be configured todetermine existence of the appropriate protocols for a particular VNFelement, determine if traffic volumes/ratios are appropriate, ifsuccess/failure rates exceed typical success/failure rates, if responsetime is within an acceptable range, and the like. Furthermore, the SCIE116 may evaluate misbehaving TCP metrics for each VNF element. At 308,the SCIE 116 determines if there are any unhealthy VNF service chains.In other words, the SCIE 116 attempts to identify all chains that arenot performing according to specifications and/or service chains that donot meet one or more predefined requirements. In response to determiningthat all service chains are performing as expected (decision block 308,“No” branch), the SCIE 116 returns back to step 302 and periodicallyrepeats steps 304-308. In response to determining that one or moreservice chains are not performing as expected, at step 310, the SCIE 116may optionally perform additional analysis to identify a root cause of“unhealthy” service chain. Any metric indicating a particular event thatcaused a change in service state/performance can be evaluated.Alternatively, any service chained element and/or interdependencybetween elements can be evaluated by the SCIE 116. There might bemultiple service chain elements associated with a particular root cause,when it is evaluated.

Once the SCIE 116 identifies a root cause, at step 312, the SCIE 116 maygenerate an alarm notification. In one embodiment, the SCIE 116 mayinclude a graphical user interface (GUI) presenting users with visualalarm notifications for a plurality of VNF service chains. In anembodiment, these notifications may comprise real-time alarmnotifications that provides an indication of one or more issues (rootcauses) affecting a specific service chain, for example.

In summary, various embodiments of the present invention are directed toa plurality of VNFs that are interconnected through the network tosupport an application. The disclosed SCVN environment 100 facilitates ashorter and simpler service chain and application provisioning process.Advantageously, moving network functions to software/virtual layer meansthat building a service chain no longer requires acquisition of hardwareresources. Various embodiments of the present invention contemplateusing a common data model for storing service chain element healthmetrics, dimensions and normal behavior metrics. Furthermore, variousembodiments of the present invention are directed to an automatedservice chain intelligence engine (SCIE 116) that is configured to useinformation stored in the data model to identify any performance issuesindicative of health of a plurality of service chain elements.

With certain illustrated embodiments described above, it is to beappreciated that various non-limiting embodiments described herein maybe used separately, combined or selectively combined for specificapplications. Further, some of the various features of the abovenon-limiting embodiments may be used without the corresponding use ofother described features. The foregoing description should therefore beconsidered as merely illustrative of the principles, teachings andexemplary embodiments of this invention, and not in limitation thereof.

It is to be understood that the above-described arrangements are onlyillustrative of the application of the principles of the illustratedembodiments. Numerous modifications and alternative arrangements may bedevised by those skilled in the art without departing from the scope ofthe illustrated embodiments, and the appended claims are intended tocover such modifications and arrangements.

What is claimed:
 1. A computer system for performing computer networkservice chain analytics, the system comprising: one or morenetwork-connected devices containing a plurality of virtual networkfunctions (VNFs) having one or more elements; a data model for storing aplurality of metrics related to the plurality of VNFs; and a servicechain intelligence engine comprising a processor and a memory devicecoupled to the processor in communication with the one or morenetwork-connected devices and in communication with the data model, thememory device containing a set of instructions that, when executed bythe processor, cause the processor to: analyze the plurality of VNFs toautomatically identify one or more service chains; automaticallydetermine performance behavior characteristics of each element for eachof the identified service chains using the data model; and automaticallygenerate an alarm, in response to determining that the performancebehavior characteristics of one or more elements of at least one of theidentified one or more service chains does not meet a predefined set ofthe performance behavior characteristics.
 2. The computer system ofclaim 1, wherein at least some of the plurality of VNFs comprise one ormore VNF service chains.
 3. The computer system of claim 2, whereinservices provided in the VNF service chains comprise one or more of:Voice-over-IP (VoIP), Video-on-Demand (VOD), IP Mobility Subsystem (IMS)and Internet services to clients of a service provider network.
 4. Thecomputer system of claim 2, wherein each of the one or more VNF servicechains comprises a plurality of VNF macro elements.
 5. The computersystem of claim 4, wherein each of the one or more VNF service chainscomprises two or more VNF micro elements.
 6. The computer system ofclaim 5, wherein the instructions that cause the processor toautomatically determine performance behavior characteristics of eachelement for each of the identified service chains using the data modelfurther comprise instructions to automatically determine performancebehavior characteristics of both macro and micro elements in the one ormore VNF service chains using the data model.
 7. The computer system ofclaim 6, wherein the data model is configured for storing service chainelement health metrics, dimensions and normal behavior metrics.
 8. Thecomputer system of claim 6, wherein the instructions that cause theprocessor to automatically determine performance behaviorcharacteristics of each element for each of the identified servicechains using the data model further comprise instructions toautomatically determine performance behavior characteristics of bothmacro and micro elements by employing active agent test data.
 9. Thecomputer system of claim 8, wherein the active agent test data is acommon piece of code inserted into each VNF element to performpre-determined availability and latency tests within certain links ofthe one or more VNF service chains.
 10. A computer method for performingcomputer network service chain analytics, the method comprising stepsof: analyzing a plurality of virtual network functions (VNFs) having oneor more elements to automatically identify one or more service chains;automatically determining performance behavior characteristics of eachelement for each of the identified service chains using a data model forstoring a plurality of metrics related to the plurality of VNFs; andautomatically generating an alarm, in response to determining that theperformance behavior characteristics of one or more elements of at leastone of the identified one or more service chains does not meet apredefined set of the performance behavior characteristics.
 11. Thecomputer method of claim 10, wherein at least some of the plurality ofVNFs comprise one or more VNF service chains.
 12. The computer method ofclaim 11, wherein services provided in the VNF service chains compriseone or more of: Voice-over-IP (VoIP), Video-on-Demand (VOD), IP MobilitySubsystem (IMS) and Internet services to clients of a service providernetwork.
 13. The computer method of claim 11, wherein each of the one ormore VNF service chains comprises a plurality of VNF macro elements. 14.The computer method of claim 11, wherein each of the one or more VNFservice chains comprises two or more VNF micro elements.
 15. Thecomputer method of claim 14, wherein the step of automaticallydetermining performance behavior characteristics of each element foreach of the identified service chains using the data model furthercomprises automatically determining performance behavior characteristicsof both macro and micro elements in the one or more VNF service chainsusing the data model.
 16. The computer method of claim 15, wherein thedata model is configured for storing service chain element healthmetrics, dimensions and normal behavior metrics.
 17. The computer methodof claim 15, wherein the step of automatically determining performancebehavior characteristics of each element for each of the identifiedservice chains using the data model further comprises automaticallydetermining performance behavior characteristics of both macro and microelements by employing active agent test data.
 18. The computer system ofclaim 17, wherein the active agent test data is a common piece of codeinserted into each VNF element to perform pre-determined availabilityand latency tests within certain links of the one or more VNF servicechains.
 19. A non-transitory computer readable storage medium structuredto store instructions, the instructions when executed, cause a processorin a network device in a computer network to: analyze a plurality ofvirtual network functions (VNFs) having one or more elements toautomatically identify one or more service chains; automaticallydetermine performance behavior characteristics of each element for eachof the identified service chains using a data model for storing aplurality of metrics related to the plurality of VNFs; and automaticallygenerate an alarm, in response to determining that the performancebehavior characteristics of one or more elements of at least one of theidentified one or more service chains does not meet a predefined set ofthe performance behavior characteristics.
 20. The storage medium ofclaim 19, wherein at least some of the plurality of VNFs comprise one ormore VNF service chains.